It's strange how often this happens. We spend real time finding novel attack surface in a target and building a working exploit, and within hours of finding it, multiple other people claim bugs with similar capability in the same target. Coincidence, or is something fishy going on? This isn't the first or second time for us. Not sure they're all dupes, but of the ones we've seen so far, it's about half and half. Meanwhile, we hold ours until we've fully analyzed the impact. We like to hand-pick findings and polish the write-ups before sending them to maintainers and vendors, so we add as little to their burden as possible. But that costs us time, especially with whatever phenomenon this is. Maybe we should just report as soon as we find something plausible. Then again, I'm not sure that's even what's going on. It's possible that everyone became super hackers now, which isn't the worst thing, I guess. We've always wanted more competent people and teams to help with finding vulns :p (but it still hurts when you get sniped)

At least after all these live-fire drills we are going through, hopefully we’ll be in better shape to deploy patches when even nastier bugs land in the future.

We could've used this "feature" to lower Xint's cost significantly. Obviously we decided to responsibly disclose the bug. It was promptly fixed by @OpenAI team, but $600 for something that has far greater business / financial impact was a little insulting tbh 😭

This legit makes me want to go back to school after 15 years since I graduated. If you are a CMU student, make sure you take this opportunity! You’ll probably learn far more than just compilers from @realGeorgeHotz. syllabus: gist.github.com/geohot/47685…